Object-capability SQL sandboxing for LLM agents — $1K CTF bounty to break it